Deployment Architecture

Multisite Indexer Clustering: How to configure site_replication_factor for two sites so site2 has its own data and a copy of site1, but have site1 only have its own data?


Hi all,

I'm demoing out a setup with two sites, but the only thing site 2 has is an Indexer. The only purpose of the second site's indexer is disaster recovery. The idea is that I want site 2 (IDX2) to have a copy of itself and site 1 (IDX1). However, I only want site 1 to have its own data and not a copy of site 2.

I've been playing around with site_replication_factor and the I think the secret lays in the origin, but I'm really having a hard time wrapping my head around it.

Thanks for any information you can provide!


You can't do it with the search and replication factors.

The best solution is "don't forward any data to site2 indexers." Make sure your forwarders are only sending data to site1 indexers.
If you aren't forwarding any data to site2, it will not be the origin for any data - and so it won't have anything to replicate, regardless of the settings.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!